@parmanasystems/verifier 1.0.19 → 1.4.0

package/dist/index.js

@@ -25,8 +25,8 @@ function verifyAttestation(attestation, verifier, runtimeManifest) {
 }
 
 // src/verify-bundle.ts
-import fs from "fs";
-import path from "path";
+import * as fs from "fs";
+import * as path from "path";
 import {
   readManifest,
   verifyManifest

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/verify-attestation.ts","../src/verify-bundle.ts","../src/verify-runtime.ts","../src/verify-runtime-compatibility.ts","../src/verify-execution-requirements.ts"],"sourcesContent":["import type {\n  ExecutionAttestation,\n  RuntimeManifest,\n  Verifier\n} from \"@parmanasystems/execution\";\n\nimport type {\n  VerificationResult,\n} from \"./types\";\n\n/**\n * Verifies an ExecutionAttestation.\n *\n * Checks:\n * 1. Signature correctness\n * 2. Runtime integrity (runtime_hash match)\n *\n * NOTE:\n * Payload MUST exactly match what was signed during execution.\n */\nexport function verifyAttestation(\n  attestation: ExecutionAttestation,\n  verifier: Verifier,\n  runtimeManifest: RuntimeManifest\n): VerificationResult {\n\n  // -----------------------------\n  // Canonical payload (STRING — must match signer)\n  // -----------------------------\n  const payloadString = JSON.stringify({\n    execution_id: attestation.execution_id,\n    decision: attestation.decision,\n    execution_state: attestation.execution_state,\n    runtime_hash: attestation.runtime_hash\n  });\n\n  // -----------------------------\n  // Check 1: Signature\n  // -----------------------------\n  const signatureVerified = verifier.verify(\n    payloadString,\n    attestation.signature\n  );\n\n  // -----------------------------\n  // Check 2: Runtime binding\n  // -----------------------------\n  const runtimeVerified =\n    attestation.runtime_hash ===\n    runtimeManifest.runtime_hash;\n\n  // -----------------------------\n  // Final result\n  // -----------------------------\n  return {\n    valid:\n      signatureVerified &&\n      runtimeVerified,\n\n    checks: {\n      signature_verified: signatureVerified,\n      runtime_verified: runtimeVerified,\n      schema_compatible: true, // no longer used\n      governed: true           // implicit in attestation model\n    }\n  };\n}","import fs from \"fs\";\nimport path from \"path\";\n\nimport {\n  readManifest,\n  verifyManifest,\n} from \"@parmanasystems/bundle\";\n\nimport {\n  verifySignature,\n} from \"@parmanasystems/crypto\";\n\n/** Detailed result of a {@link verifyBundle} call. */\nexport interface BundleVerificationResult {\n  /** `true` when both the manifest content hashes and the cryptographic signature are valid. */\n  valid: boolean;\n\n  /** `true` when the content hash commitment in the manifest is consistent. */\n  manifest_verified: boolean;\n\n  /** `true` when the manifest signature passes cryptographic verification. */\n  signature_verified: boolean;\n\n  /** `true` when the on-disk directory content matches the manifest's artifact hashes. */\n  bundle_verified: boolean;\n}\n\n/**\n * Performs a full, standalone bundle verification:\n * 1. Re-hashes every artifact in the bundle directory and validates the manifest commitment.\n * 2. Verifies the Ed25519 signature in `signaturePath` against the manifest.\n *\n * Both checks must pass for `valid` to be `true`.\n *\n * @param manifestPath  - Path to `bundle.manifest.json`.\n * @param signaturePath - Path to `bundle.sig` (base64 Ed25519 signature file).\n */\nexport function verifyBundle(\n  manifestPath: string,\n  signaturePath: string\n): BundleVerificationResult {\n\n  const signature =\n    fs.readFileSync(\n      signaturePath,\n      \"utf8\"\n    );\n\n  const directory =\n    path.dirname(\n      manifestPath\n    );\n\n  const parsedManifest =\n    readManifest(directory);\n\n  const bundleVerified =\n    verifyManifest(\n      parsedManifest,\n      directory\n    ).valid;\n\n  const signatureVerified =\n    verifySignature(\n      manifestPath,\n      signature\n    );\n\n  return {\n    valid:\n      bundleVerified &&\n      signatureVerified,\n\n    manifest_verified:\n      bundleVerified &&\n      signatureVerified,\n\n    signature_verified:\n      signatureVerified,\n\n    bundle_verified:\n      bundleVerified,\n  };\n}\n\n\n\n\n","import type {\n  RuntimeManifest,\n} from \"@parmanasystems/execution\";\n\n/** Result of verifying that a runtime manifest declares a required set of capabilities. */\nexport interface RuntimeVerificationResult {\n  /** `true` when the runtime declares all required capabilities. */\n  valid: boolean;\n\n  /** Capability strings that are required but not declared by the runtime. */\n  missing_capabilities: string[];\n}\n\n/**\n * Checks that `manifest.capabilities` contains every entry in `requiredCapabilities`.\n *\n * @param manifest             - The runtime manifest to check.\n * @param requiredCapabilities - The capability strings that must be present.\n */\nexport function verifyRuntime(\n  manifest: RuntimeManifest,\n  requiredCapabilities: string[]\n): RuntimeVerificationResult {\n\n  const missing =\n    requiredCapabilities.filter(\n      capability =>\n        !manifest.capabilities.includes(\n          capability\n        )\n    );\n\n  return {\n    valid:\n      missing.length === 0,\n\n    missing_capabilities:\n      missing,\n  };\n}\n\n\n\n\n","import type {\n  RuntimeManifest,\n} from \"@parmanasystems/execution\";\n\nimport type {\n  RuntimeRequirements,\n} from \"@parmanasystems/governance\";\n\n/**\n * Full compatibility result produced by {@link verifyRuntimeCompatibility}.\n * Separates capability gaps from version incompatibilities so each dimension\n * can be reported or acted on independently.\n */\nexport interface RuntimeCompatibilityResult {\n  /** `true` when the runtime satisfies all capability, version, and schema requirements. */\n  valid: boolean;\n\n  /** Capability strings required by the bundle but absent from the runtime. */\n  missing_capabilities: string[];\n\n  /** `true` when the runtime version is not in `requirements.supported_runtime_versions`. */\n  unsupported_runtime_version: boolean;\n\n  /**\n   * `true` when none of the schema versions supported by the runtime appear in\n   * `requirements.supported_schema_versions`.\n   */\n  unsupported_schema_version: boolean;\n}\n\n/**\n * Performs a comprehensive compatibility check between a runtime manifest and\n * the requirements declared by a bundle.  Checks capabilities, runtime version,\n * and schema version overlap in a single pass.\n *\n * Use this before issuing an execution token to surface all incompatibilities\n * at once rather than discovering them one at a time.\n *\n * @param manifest     - The runtime manifest to evaluate.\n * @param requirements - The bundle's declared runtime requirements.\n */\nexport function verifyRuntimeCompatibility(\n  manifest: RuntimeManifest,\n  requirements: RuntimeRequirements\n): RuntimeCompatibilityResult {\n\n  const missingCapabilities =\n    requirements.required_capabilities.filter(\n      capability =>\n        !manifest.capabilities.includes(\n          capability\n        )\n    );\n\n  const unsupportedRuntime =\n    !requirements.supported_runtime_versions.includes(\n      manifest.runtime_version\n    );\n\n  const unsupportedSchema =\n    requirements.supported_schema_versions.every(\n      (\n        schemaVersion\n      ) =>\n        !manifest.supported_schema_versions.includes(\n          schemaVersion\n        )\n    );\n\n  return {\n    valid:\n      missingCapabilities.length === 0 &&\n      !unsupportedRuntime &&\n      !unsupportedSchema,\n\n    missing_capabilities:\n      missingCapabilities,\n\n    unsupported_runtime_version:\n      unsupportedRuntime,\n\n    unsupported_schema_version:\n      unsupportedSchema,\n  };\n}\n\n\n\n\n","import type {\n  RuntimeManifest,\n} from \"@parmanasystems/execution\";\n\n/** Result of verifying that a runtime satisfies a set of execution security requirements. */\nexport interface ExecutionRequirementResult {\n  /** `true` when the runtime satisfies all requirements. */\n  valid: boolean;\n\n  /** List of capability strings that are required but absent from the runtime. */\n  missing_requirements: string[];\n}\n\ntype ExecutionRequirementsInput = {\n  replay_protection_required?: boolean;\n  attestation_required?: boolean;\n  audit_chain_required?: boolean;\n  [key: string]: boolean | undefined;\n};\n\n/**\n * Checks that `manifest.capabilities` satisfies every flag set in\n * `requirements`.  Returns the list of missing capabilities so callers can\n * produce actionable error messages.\n *\n * @param manifest     - The runtime manifest to test.\n * @param requirements - The execution security requirements to check against.\n */\nexport function verifyExecutionRequirements(\n  manifest: RuntimeManifest,\n  requirements: ExecutionRequirementsInput\n): ExecutionRequirementResult {\n\n  const missing: string[] = [];\n\n  if (\n    requirements.replay_protection_required &&\n    !manifest.capabilities.includes(\n      \"replay-protection\"\n    )\n  ) {\n    missing.push(\n      \"replay-protection\"\n    );\n  }\n\n  if (\n    requirements.attestation_required &&\n    !manifest.capabilities.includes(\n      \"attestation-signing\"\n    )\n  ) {\n    missing.push(\n      \"attestation-signing\"\n    );\n  }\n\n  if (\n    requirements.audit_chain_required &&\n    !manifest.capabilities.includes(\n      \"bundle-verification\"\n    )\n  ) {\n    missing.push(\n      \"bundle-verification\"\n    );\n  }\n\n  return {\n    valid:\n      missing.length === 0,\n\n    missing_requirements:\n      missing,\n  };\n}\n\n\n\n"],"mappings":";AAoBO,SAAS,kBACd,aACA,UACA,iBACoB;AAKpB,QAAM,gBAAgB,KAAK,UAAU;AAAA,IACnC,cAAc,YAAY;AAAA,IAC1B,UAAU,YAAY;AAAA,IACtB,iBAAiB,YAAY;AAAA,IAC7B,cAAc,YAAY;AAAA,EAC5B,CAAC;AAKD,QAAM,oBAAoB,SAAS;AAAA,IACjC;AAAA,IACA,YAAY;AAAA,EACd;AAKA,QAAM,kBACJ,YAAY,iBACZ,gBAAgB;AAKlB,SAAO;AAAA,IACL,OACE,qBACA;AAAA,IAEF,QAAQ;AAAA,MACN,oBAAoB;AAAA,MACpB,kBAAkB;AAAA,MAClB,mBAAmB;AAAA;AAAA,MACnB,UAAU;AAAA;AAAA,IACZ;AAAA,EACF;AACF;;;AClEA,OAAO,QAAQ;AACf,OAAO,UAAU;AAEjB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,OACK;AA2BA,SAAS,aACd,cACA,eAC0B;AAE1B,QAAM,YACJ,GAAG;AAAA,IACD;AAAA,IACA;AAAA,EACF;AAEF,QAAM,YACJ,KAAK;AAAA,IACH;AAAA,EACF;AAEF,QAAM,iBACJ,aAAa,SAAS;AAExB,QAAM,iBACJ;AAAA,IACE;AAAA,IACA;AAAA,EACF,EAAE;AAEJ,QAAM,oBACJ;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAEF,SAAO;AAAA,IACL,OACE,kBACA;AAAA,IAEF,mBACE,kBACA;AAAA,IAEF,oBACE;AAAA,IAEF,iBACE;AAAA,EACJ;AACF;;;AChEO,SAAS,cACd,UACA,sBAC2B;AAE3B,QAAM,UACJ,qBAAqB;AAAA,IACnB,gBACE,CAAC,SAAS,aAAa;AAAA,MACrB;AAAA,IACF;AAAA,EACJ;AAEF,SAAO;AAAA,IACL,OACE,QAAQ,WAAW;AAAA,IAErB,sBACE;AAAA,EACJ;AACF;;;ACEO,SAAS,2BACd,UACA,cAC4B;AAE5B,QAAM,sBACJ,aAAa,sBAAsB;AAAA,IACjC,gBACE,CAAC,SAAS,aAAa;AAAA,MACrB;AAAA,IACF;AAAA,EACJ;AAEF,QAAM,qBACJ,CAAC,aAAa,2BAA2B;AAAA,IACvC,SAAS;AAAA,EACX;AAEF,QAAM,oBACJ,aAAa,0BAA0B;AAAA,IACrC,CACE,kBAEA,CAAC,SAAS,0BAA0B;AAAA,MAClC;AAAA,IACF;AAAA,EACJ;AAEF,SAAO;AAAA,IACL,OACE,oBAAoB,WAAW,KAC/B,CAAC,sBACD,CAAC;AAAA,IAEH,sBACE;AAAA,IAEF,6BACE;AAAA,IAEF,4BACE;AAAA,EACJ;AACF;;;ACxDO,SAAS,4BACd,UACA,cAC4B;AAE5B,QAAM,UAAoB,CAAC;AAE3B,MACE,aAAa,8BACb,CAAC,SAAS,aAAa;AAAA,IACrB;AAAA,EACF,GACA;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,MACE,aAAa,wBACb,CAAC,SAAS,aAAa;AAAA,IACrB;AAAA,EACF,GACA;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,MACE,aAAa,wBACb,CAAC,SAAS,aAAa;AAAA,IACrB;AAAA,EACF,GACA;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OACE,QAAQ,WAAW;AAAA,IAErB,sBACE;AAAA,EACJ;AACF;","names":[]}
+{"version":3,"sources":["../src/verify-attestation.ts","../src/verify-bundle.ts","../src/verify-runtime.ts","../src/verify-runtime-compatibility.ts","../src/verify-execution-requirements.ts"],"sourcesContent":["import type {\r\n  ExecutionAttestation,\r\n  RuntimeManifest,\r\n  Verifier\r\n} from \"@parmanasystems/execution\";\r\n\r\nimport type {\r\n  VerificationResult,\r\n} from \"./types.js\";\r\n\r\n/**\r\n * Verifies an ExecutionAttestation.\r\n *\r\n * Checks:\r\n * 1. Signature correctness\r\n * 2. Runtime integrity (runtime_hash match)\r\n *\r\n * NOTE:\r\n * Payload MUST exactly match what was signed during execution.\r\n */\r\nexport function verifyAttestation(\r\n  attestation: ExecutionAttestation,\r\n  verifier: Verifier,\r\n  runtimeManifest: RuntimeManifest\r\n): VerificationResult {\r\n\r\n  // -----------------------------\r\n  // Canonical payload (STRING — must match signer)\r\n  // -----------------------------\r\n  const payloadString = JSON.stringify({\r\n    execution_id: attestation.execution_id,\r\n    decision: attestation.decision,\r\n    execution_state: attestation.execution_state,\r\n    runtime_hash: attestation.runtime_hash\r\n  });\r\n\r\n  // -----------------------------\r\n  // Check 1: Signature\r\n  // -----------------------------\r\n  const signatureVerified = verifier.verify(\r\n    payloadString,\r\n    attestation.signature\r\n  );\r\n\r\n  // -----------------------------\r\n  // Check 2: Runtime binding\r\n  // -----------------------------\r\n  const runtimeVerified =\r\n    attestation.runtime_hash ===\r\n    runtimeManifest.runtime_hash;\r\n\r\n  // -----------------------------\r\n  // Final result\r\n  // -----------------------------\r\n  return {\r\n    valid:\r\n      signatureVerified &&\r\n      runtimeVerified,\r\n\r\n    checks: {\r\n      signature_verified: signatureVerified,\r\n      runtime_verified: runtimeVerified,\r\n      schema_compatible: true, // no longer used\r\n      governed: true           // implicit in attestation model\r\n    }\r\n  };\r\n}\r\n","import * as fs from \"node:fs\";\r\nimport * as path from \"node:path\";\r\n\r\nimport {\r\n  readManifest,\r\n  verifyManifest,\r\n} from \"@parmanasystems/bundle\";\r\n\r\nimport {\r\n  verifySignature,\r\n} from \"@parmanasystems/crypto\";\r\n\r\n/** Detailed result of a {@link verifyBundle} call. */\r\nexport interface BundleVerificationResult {\r\n  /** `true` when both the manifest content hashes and the cryptographic signature are valid. */\r\n  valid: boolean;\r\n\r\n  /** `true` when the content hash commitment in the manifest is consistent. */\r\n  manifest_verified: boolean;\r\n\r\n  /** `true` when the manifest signature passes cryptographic verification. */\r\n  signature_verified: boolean;\r\n\r\n  /** `true` when the on-disk directory content matches the manifest's artifact hashes. */\r\n  bundle_verified: boolean;\r\n}\r\n\r\n/**\r\n * Performs a full, standalone bundle verification:\r\n * 1. Re-hashes every artifact in the bundle directory and validates the manifest commitment.\r\n * 2. Verifies the Ed25519 signature in `signaturePath` against the manifest.\r\n *\r\n * Both checks must pass for `valid` to be `true`.\r\n *\r\n * @param manifestPath  - Path to `bundle.manifest.json`.\r\n * @param signaturePath - Path to `bundle.sig` (base64 Ed25519 signature file).\r\n */\r\nexport function verifyBundle(\r\n  manifestPath: string,\r\n  signaturePath: string\r\n): BundleVerificationResult {\r\n\r\n  const signature =\r\n    fs.readFileSync(\r\n      signaturePath,\r\n      \"utf8\"\r\n    );\r\n\r\n  const directory =\r\n    path.dirname(\r\n      manifestPath\r\n    );\r\n\r\n  const parsedManifest =\r\n    readManifest(directory);\r\n\r\n  const bundleVerified =\r\n    verifyManifest(\r\n      parsedManifest,\r\n      directory\r\n    ).valid;\r\n\r\n  const signatureVerified =\r\n    verifySignature(\r\n      manifestPath,\r\n      signature\r\n    );\r\n\r\n  return {\r\n    valid:\r\n      bundleVerified &&\r\n      signatureVerified,\r\n\r\n    manifest_verified:\r\n      bundleVerified &&\r\n      signatureVerified,\r\n\r\n    signature_verified:\r\n      signatureVerified,\r\n\r\n    bundle_verified:\r\n      bundleVerified,\r\n  };\r\n}\r\n\r\n\r\n\r\n\r\n","import type {\r\n  RuntimeManifest,\r\n} from \"@parmanasystems/execution\";\r\n\r\n/** Result of verifying that a runtime manifest declares a required set of capabilities. */\r\nexport interface RuntimeVerificationResult {\r\n  /** `true` when the runtime declares all required capabilities. */\r\n  valid: boolean;\r\n\r\n  /** Capability strings that are required but not declared by the runtime. */\r\n  missing_capabilities: string[];\r\n}\r\n\r\n/**\r\n * Checks that `manifest.capabilities` contains every entry in `requiredCapabilities`.\r\n *\r\n * @param manifest             - The runtime manifest to check.\r\n * @param requiredCapabilities - The capability strings that must be present.\r\n */\r\nexport function verifyRuntime(\r\n  manifest: RuntimeManifest,\r\n  requiredCapabilities: string[]\r\n): RuntimeVerificationResult {\r\n\r\n  const missing =\r\n    requiredCapabilities.filter(\r\n      capability =>\r\n        !manifest.capabilities.includes(\r\n          capability\r\n        )\r\n    );\r\n\r\n  return {\r\n    valid:\r\n      missing.length === 0,\r\n\r\n    missing_capabilities:\r\n      missing,\r\n  };\r\n}\r\n\r\n\r\n\r\n\r\n","import type {\r\n  RuntimeManifest,\r\n} from \"@parmanasystems/execution\";\r\n\r\nimport type {\r\n  RuntimeRequirements,\r\n} from \"@parmanasystems/governance\";\r\n\r\n/**\r\n * Full compatibility result produced by {@link verifyRuntimeCompatibility}.\r\n * Separates capability gaps from version incompatibilities so each dimension\r\n * can be reported or acted on independently.\r\n */\r\nexport interface RuntimeCompatibilityResult {\r\n  /** `true` when the runtime satisfies all capability, version, and schema requirements. */\r\n  valid: boolean;\r\n\r\n  /** Capability strings required by the bundle but absent from the runtime. */\r\n  missing_capabilities: string[];\r\n\r\n  /** `true` when the runtime version is not in `requirements.supported_runtime_versions`. */\r\n  unsupported_runtime_version: boolean;\r\n\r\n  /**\r\n   * `true` when none of the schema versions supported by the runtime appear in\r\n   * `requirements.supported_schema_versions`.\r\n   */\r\n  unsupported_schema_version: boolean;\r\n}\r\n\r\n/**\r\n * Performs a comprehensive compatibility check between a runtime manifest and\r\n * the requirements declared by a bundle.  Checks capabilities, runtime version,\r\n * and schema version overlap in a single pass.\r\n *\r\n * Use this before issuing an execution token to surface all incompatibilities\r\n * at once rather than discovering them one at a time.\r\n *\r\n * @param manifest     - The runtime manifest to evaluate.\r\n * @param requirements - The bundle's declared runtime requirements.\r\n */\r\nexport function verifyRuntimeCompatibility(\r\n  manifest: RuntimeManifest,\r\n  requirements: RuntimeRequirements\r\n): RuntimeCompatibilityResult {\r\n\r\n  const missingCapabilities =\r\n    requirements.required_capabilities.filter(\r\n      capability =>\r\n        !manifest.capabilities.includes(\r\n          capability\r\n        )\r\n    );\r\n\r\n  const unsupportedRuntime =\r\n    !requirements.supported_runtime_versions.includes(\r\n      manifest.runtime_version\r\n    );\r\n\r\n  const unsupportedSchema =\r\n    requirements.supported_schema_versions.every(\r\n      (\r\n        schemaVersion\r\n      ) =>\r\n        !manifest.supported_schema_versions.includes(\r\n          schemaVersion\r\n        )\r\n    );\r\n\r\n  return {\r\n    valid:\r\n      missingCapabilities.length === 0 &&\r\n      !unsupportedRuntime &&\r\n      !unsupportedSchema,\r\n\r\n    missing_capabilities:\r\n      missingCapabilities,\r\n\r\n    unsupported_runtime_version:\r\n      unsupportedRuntime,\r\n\r\n    unsupported_schema_version:\r\n      unsupportedSchema,\r\n  };\r\n}\r\n\r\n\r\n\r\n\r\n","import type {\r\n  RuntimeManifest,\r\n} from \"@parmanasystems/execution\";\r\n\r\n/** Result of verifying that a runtime satisfies a set of execution security requirements. */\r\nexport interface ExecutionRequirementResult {\r\n  /** `true` when the runtime satisfies all requirements. */\r\n  valid: boolean;\r\n\r\n  /** List of capability strings that are required but absent from the runtime. */\r\n  missing_requirements: string[];\r\n}\r\n\r\ntype ExecutionRequirementsInput = {\r\n  replay_protection_required?: boolean;\r\n  attestation_required?: boolean;\r\n  audit_chain_required?: boolean;\r\n  [key: string]: boolean | undefined;\r\n};\r\n\r\n/**\r\n * Checks that `manifest.capabilities` satisfies every flag set in\r\n * `requirements`.  Returns the list of missing capabilities so callers can\r\n * produce actionable error messages.\r\n *\r\n * @param manifest     - The runtime manifest to test.\r\n * @param requirements - The execution security requirements to check against.\r\n */\r\nexport function verifyExecutionRequirements(\r\n  manifest: RuntimeManifest,\r\n  requirements: ExecutionRequirementsInput\r\n): ExecutionRequirementResult {\r\n\r\n  const missing: string[] = [];\r\n\r\n  if (\r\n    requirements.replay_protection_required &&\r\n    !manifest.capabilities.includes(\r\n      \"replay-protection\"\r\n    )\r\n  ) {\r\n    missing.push(\r\n      \"replay-protection\"\r\n    );\r\n  }\r\n\r\n  if (\r\n    requirements.attestation_required &&\r\n    !manifest.capabilities.includes(\r\n      \"attestation-signing\"\r\n    )\r\n  ) {\r\n    missing.push(\r\n      \"attestation-signing\"\r\n    );\r\n  }\r\n\r\n  if (\r\n    requirements.audit_chain_required &&\r\n    !manifest.capabilities.includes(\r\n      \"bundle-verification\"\r\n    )\r\n  ) {\r\n    missing.push(\r\n      \"bundle-verification\"\r\n    );\r\n  }\r\n\r\n  return {\r\n    valid:\r\n      missing.length === 0,\r\n\r\n    missing_requirements:\r\n      missing,\r\n  };\r\n}\r\n\r\n\r\n\r\n"],"mappings":";AAoBO,SAAS,kBACd,aACA,UACA,iBACoB;AAKpB,QAAM,gBAAgB,KAAK,UAAU;AAAA,IACnC,cAAc,YAAY;AAAA,IAC1B,UAAU,YAAY;AAAA,IACtB,iBAAiB,YAAY;AAAA,IAC7B,cAAc,YAAY;AAAA,EAC5B,CAAC;AAKD,QAAM,oBAAoB,SAAS;AAAA,IACjC;AAAA,IACA,YAAY;AAAA,EACd;AAKA,QAAM,kBACJ,YAAY,iBACZ,gBAAgB;AAKlB,SAAO;AAAA,IACL,OACE,qBACA;AAAA,IAEF,QAAQ;AAAA,MACN,oBAAoB;AAAA,MACpB,kBAAkB;AAAA,MAClB,mBAAmB;AAAA;AAAA,MACnB,UAAU;AAAA;AAAA,IACZ;AAAA,EACF;AACF;;;AClEA,YAAY,QAAQ;AACpB,YAAY,UAAU;AAEtB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,OACK;AA2BA,SAAS,aACd,cACA,eAC0B;AAE1B,QAAM,YACD;AAAA,IACD;AAAA,IACA;AAAA,EACF;AAEF,QAAM,YACC;AAAA,IACH;AAAA,EACF;AAEF,QAAM,iBACJ,aAAa,SAAS;AAExB,QAAM,iBACJ;AAAA,IACE;AAAA,IACA;AAAA,EACF,EAAE;AAEJ,QAAM,oBACJ;AAAA,IACE;AAAA,IACA;AAAA,EACF;AAEF,SAAO;AAAA,IACL,OACE,kBACA;AAAA,IAEF,mBACE,kBACA;AAAA,IAEF,oBACE;AAAA,IAEF,iBACE;AAAA,EACJ;AACF;;;AChEO,SAAS,cACd,UACA,sBAC2B;AAE3B,QAAM,UACJ,qBAAqB;AAAA,IACnB,gBACE,CAAC,SAAS,aAAa;AAAA,MACrB;AAAA,IACF;AAAA,EACJ;AAEF,SAAO;AAAA,IACL,OACE,QAAQ,WAAW;AAAA,IAErB,sBACE;AAAA,EACJ;AACF;;;ACEO,SAAS,2BACd,UACA,cAC4B;AAE5B,QAAM,sBACJ,aAAa,sBAAsB;AAAA,IACjC,gBACE,CAAC,SAAS,aAAa;AAAA,MACrB;AAAA,IACF;AAAA,EACJ;AAEF,QAAM,qBACJ,CAAC,aAAa,2BAA2B;AAAA,IACvC,SAAS;AAAA,EACX;AAEF,QAAM,oBACJ,aAAa,0BAA0B;AAAA,IACrC,CACE,kBAEA,CAAC,SAAS,0BAA0B;AAAA,MAClC;AAAA,IACF;AAAA,EACJ;AAEF,SAAO;AAAA,IACL,OACE,oBAAoB,WAAW,KAC/B,CAAC,sBACD,CAAC;AAAA,IAEH,sBACE;AAAA,IAEF,6BACE;AAAA,IAEF,4BACE;AAAA,EACJ;AACF;;;ACxDO,SAAS,4BACd,UACA,cAC4B;AAE5B,QAAM,UAAoB,CAAC;AAE3B,MACE,aAAa,8BACb,CAAC,SAAS,aAAa;AAAA,IACrB;AAAA,EACF,GACA;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,MACE,aAAa,wBACb,CAAC,SAAS,aAAa;AAAA,IACrB;AAAA,EACF,GACA;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,MACE,aAAa,wBACb,CAAC,SAAS,aAAa;AAAA,IACrB;AAAA,EACF,GACA;AACA,YAAQ;AAAA,MACN;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OACE,QAAQ,WAAW;AAAA,IAErB,sBACE;AAAA,EACJ;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parmanasystems/verifier",
-  "version": "1.0.19",
+  "version": "1.4.0",
   "private": false,
   "type": "module",
   "scripts": {
@@ -18,9 +18,9 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@parmanasystems/crypto": "^1.0.19",
-    "@parmanasystems/execution": "^1.0.19",
-    "@parmanasystems/governance": "^1.0.19"
+    "@parmanasystems/crypto": "^1.4.0",
+    "@parmanasystems/execution": "^1.4.0",
+    "@parmanasystems/governance": "^1.4.0"
   },
   "description": "Independent governance verification infrastructure for deterministic parmanasystems workflows.",
   "license": "Apache-2.0",